TorBrowser's modifications to NoScript's mandatory whitelist break some webextensions when permissions are cascaded

https://forums.informaction.com/viewtopic.php?f=7&t=24484&sid=HELLO

Just try it. Tested by myself.

added TorBrowserTeam201802R in Legacy / Trac component::applications/tor browser in Legacy / Trac owner::tbb-team in Legacy / Trac priority::high in Legacy / Trac resolution::fixed in Legacy / Trac severity::normal in Legacy / Trac status::closed in Legacy / Trac tbb-backported in Legacy / Trac type::defect in Legacy / Trac labels

I've already asked for help at Tor, but they don't care so I am asking here.

Tor Browser is including NoScript, your addon, and it's breaking other add-on's functionality.

To reproduce:
1. Download latest Tor Browser from the Tor project(7.5).
2. Go to https://trac.torproject.org/projects/tor/ticket/24943 and download a ZIP file in description.
3. Extract the zip.
4. In Tor browser, open about:addon, Gear, Debug add-on.
5. "Load temporary add-on", select "local/manifest.json" to load this test add-on.
6. Try to save something. When you click Save, it clear everything.

The problem will go away if you disable NoScript in Tor Browser.
Can you do something about this? Other addons on AMO which use browser.storage.local is suffering by this.

FWIW this does not seem to be a NoScript problem. I get the same behavior when I removed NoScript from the browser. Just used a vanilla Tor Browser to test that.

Trac:
Summary: TorBrowser's NoScript is breaking add-on system to TorBrowser's breaking add-ons using browser.storage.local

Trac:
Priority: High to Medium

Hi gk, did you tried comment:1's test add-on?

When I tried it on my fresh VM, it didn't work. After I disabled NoScript from about:addons, the test add-on worked correctly, saving my memo.

1 Fresh Windows 7 Virtual Machine 1 Tor Browser 7.5 downloaded from Tor project 1 Add-on zip from comment:1

I installed TB7.5 on Win7. Then I opened TB and went to about:add-ons, debug add-on, and load "local/manifest.json". Open about:add-ons and clicked the test add-on. Typed "tor" to the textarea and clicked "Save" button ---> everything cleared instantly

Went to about:add-ons and clicked NoScript's Disable button. Clicked the "Options" button of the test add-on. Typed "tor" to the textarea and clicked "Save" button ---> Saved

gk, are you using Linux? This might be a difference.

Related to: https://github.com/nym-zone/block_cloudflare_mitm_fx/issues/14#issuecomment-357488295

@gk

legacy/trac#24783 (moved) is about browser.storage.'sync'. The "browser.storage.local" should work on Firefox ESR 52 series including Tor Browser.

Yes, I tested on Linux. I resolved legacy/trac#24943 (moved) as a duplicate of this one.

Trac:

win7 test

Attached image result(tested on VM) Also tested on friend's live PC with TBB 7.5. Same result.

Trac:
Points: N/A to 100

I have 1 nonofficial addon in my TBB and 7.5 killed it. Windows 10. The add-on's settings are purged. I'm asking add-on's developer about this but it looks like this is the cause of the problem.

Trac:
Priority: Medium to High
Summary: TorBrowser's breaking add-ons using browser.storage.local to TorBrowser's NoScript is breaking add-on system

Need other test result from MacOS and Linux users.

Trac:
Status: new to needs_information

NoScript version 5.1.8.3 have a problem. I had to revert my browser...

Trac:
Username: sundayworker

Is there any valid reason why [System+Principal] (which is the very first entry in NoScript 5's "stock" mandatory whitelist) is not included in the default Tor Browser whitelist?

Anyway, this absence is the culprit (and in facts, this problem happens only in the Tor Browser which deploys its "special" shortlisted mandatory whitelist).

The Tor Browser enforces permissions cascading, and in the Add-ons Options window the top frame is about:addons, whose principal's origin is [System+Principal]. Since this origin is omitted from Tor Browser's version of NoScript mandatory whitelist, the top site by default is considered forbidden, cascading down script blocking to the WebExtension's subframe.

Temporary work-around for users having this problem: manually add [System+Principal] to your whitelist.

Trac:
Summary: TorBrowser's NoScript is breaking add-on system to TorBrowser's modifications to NoScript's mandatory whitelist break some webextensions

I have 2 TBBs. Both are upgraded from old versions, time to time. 5.x -> 6.x -> 7.5

Both have 3 webext add-ons and these are working just fine.

When I downloaded fresh TBB, webext is not working at all. I think this issue is happning on 7.0/7.5 new users. Old users like me shouldn't have this issue.

And,

[System+Principal]

is NOT exist in my whitelist (Noscript options - Whitelist). Both TBBs don't have it, but able to use webexts.

I wonder why.

So, which title is correct?

Trac:
Summary: TorBrowser's modifications to NoScript's mandatory whitelist break some webextensions to TorBrowser's NoScript is breaking add-on system